IN THE SPECIFICATION 
Please replace the paragraph at page 28, line 20, to page 29, line 4, with the following 
rewritten paragraph: 

Initially, the communication section 132 of the backend apparatus 33© 430 receives 
information specifying rn, products distribution information pd and tag output information 
G(sk, i) which are transmitted from the reader 120 (step S50). Information specifying rn, the 
products distribution information pd and the tag output information G(s k , 0 which have been 
received are stored in the memory 136a. Then the controller 136 enters 1 for n, and stores it 
in the memory 136a (step S51). The controller 136 then causes a hash calculator 433 to 
extract a confidential value Sn, i from the database memory 131 while referring to values of n 
and j in the memory 136a (step S52), and causes the hash function H to be applied thereto rn 
times and also causes the hash function G to be applied subsequently, thus allowing a hash 
value G(H J (Sn, 0) Q=rn) to be calculated (step S53). 

Please replace the paragraph at page 32, lines 7-24, with the following rewritten 
paragraph: 

Initially, the backend apparatus 530 receives products distribution information pd and 
tag output information E K g (Sk, i) transmitted by the reader 120 by the communication section 
132 (step S70). Received products distribution information pd and tag output information E K g 
(s k> i) are stored in the memory 136a. Then, the controller 136 enters 1 for n, and stores it in 
the memory 136a (step S71). The controller 136 then causes the encrypted function calculator 
533 (equivalent to "third calculator") to extract the confidential value s n , i from the database 
131 while referring to the value n in the memory 136a (step S72). The controller 136 then 
enters 0 for j, and stores it in the memory 136a (step S73). The controller 136 causes the 
encrypted function calculator 533 to calculate an encrypted text Ekg(E J kh (s n , i)) (equivalent 
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to "result of a calculation in the third calculator") while referring to the value of j in the 
memory 136a (step S74). It should be noted that E j kh (Sn, 1) implies applying a common key 
encryption function E to the confidential value s^ i j times using the common key KH. Then 
the comparator 134 acquires the encrypted text E K g (E J kh (s n , 1)) from the hash calculator 133 
and acquires tag output informati efl-tag output information E K g (Sk, D from the memory 136a, 
and compare them against each other (step S75). 

Please replace the paragraph at page 45, lines 3-11, with the following rewritten 
paragraph: 

[0083] Combinations of generated initial elements (fi, o, fu, o, U, o) (equivalent to 
"combinations each comprising d(d > 2) elements e U)V u(ue{l, • • • , d} ) and 
corresponding to respective tag ID information idk" where vu represents an integer equal to or 
greater than 0 and indicating the number of times the element e u , vu is updated and the suffix 
vu of the element e u , vu represents v u ) are stored in the confidential value memory 81 1 of 
respective allotted tag devices 810. In the description to follow, a combination of initial 
elements which is stored in the confidential value memory 81 1 of each tag device 810 is 
indicated by (e u 0 , .... o u , o,...,od,o gu.o e d ,o). 



Please replace the paragraph at page 45, lines 19-24, with the following rewritten 
paragraph: 

[0085] As shown in Fig. 16 A, one set of combinations of initial elements 811a ((ei, 0 ,e3^o 
£2*Q)=(bi, 2, o, b2,2,o b 2.2.o) ) which corresponds to the tag ID information id is stored in the 
confidential value memory 81 1 of the tag device 810. It is to be noted that part of the element 
e u , vu which is stored in the confidential value memory 81 1 is also stored in the confidential 
value memory of another tag device as a corresponding element in another tag device. 
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Please replace the paragraph at page 61, line 22, to page 62, line 8, with the following 
rewritten paragraph: 

An embodiment 1 1 is a modification of the embodiment 10, and differs from the 
embodiment 10 in that a manifold value z u which assumes t u kinds ( t u > 2 ) of values is 
stored for each u(ue{l, • • • , d} ) in a manifold value memory of a tag device, and a tag 
output information a k i = G(e 1 vl | z l | •■• | e d >vd | Z d ) for a bit combination value of 

each element e u> vu extracted from a confidential value memory and either one of manifold 
values z u is used as an output value. In addition, while the update of each element e u , vu in the 
confidential value memory which corresponds to each u(ue{l, • • • , d} ) is performed once 
for commutations oft times, in the embodiment 1 1, the point in time of communication when 
element e u , vu is updated is shifted, so that either one of elements e u «, vu' (u f G {1, • • d} ) in the 
confidential value memory is updated each time the tag device delivers the tag output 
information ak, i. This prevents the tag device from being traced if the tag device is tampered 
with at any point in time of communication. 

Please replace the paragraph at page 63, lines 6-18, with the following rewritten 
paragraph: 

[0124] The manifold value generator 1115 can be illustrated by a counter which counts 

z u = 1 • • • t u for each u(ue{l, • • • , d} ), a hash calculator which performs a calculation of 

z u =H(seed, x u ), X u e {1, • • • , t u } or a hash calculator which performs a calculation of 

z u =H *(s ee d) H xu (seed\ x u e {1, • • • , t u } . In the description to follow, manifold value z u is 
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expressed as z u =7T u (x u ), x u e {1, • • • , t u } . Preferably, 7T U is set up such that for an equal value 
of u, manifold values z u =7T u (x u ) corresponding to x u G {1, • • t u } do not coincide. 

Please replace the paragraph at page 65, lines 18-20, with the following rewritten 
paragraph: 

A distinction of the embodiment 1 1 over the embodiment 10 resides in that the 
processing indicated at st e p S26 Fig. 26 is performed in place of processings at steps S208 ~ 
S213 shown in Fig. 23. 

Please replace the paragraph at page 80, lines 23-27, with the following rewritten 
paragraph: 

[0159] Information such as the privileged ID information (sid h ) or the like is received by the 
communication section 62 2062 of the security server 2060 (its input is accepted) (step 
S305), and is sent to a read/write section 2064. This also triggers the random number 
generator 62 2063 (equivalent to "random value generator") to generate a random number rh 
(step S306). 

Please replace the paragraph at page 88, lines 15-20, with the following rewritten 
paragraph: 

[0173] Information including the privileged ID information sid h or the like is received by the 
communication section 2062 of the security server 2260 (step S344), and the first encrypted 
text epkj(idh | r) which constitutes the privileged ID information sid h is sent to the ID extractor 
266 2266 while the key ID information kidj is sent to the read/write section 2064. The key ID 
information kidj is also recorded in the memory 2065a. 
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Please replace the paragraph at page 103, line 24, to page 104, line 12, with the 
following rewritten paragraph: 

Initially, the controller 23- 2023 determines whether or not there existed a given 
trigger (opportunity) to update the privileged ID information (step S412). What can be cited 
as such a trigger are that the privileged ID information has been read from the tag device 
2610, that a count indicating a number of times the privileged ID information within the tag 
device 2610 has been used has reached a given value or the like. In the absence of a given 
trigger, a determination rendered at step S412 is continued, and in the presence of a given 
trigger, the read/write section 2624 (equivalent to "privileged ID extractor") extracts one 
privileged ID information sidh-j from the privileged ID memory 2625 (step S413). The 
selection of this one privileged ID information sidh-j may take place at random, or may be in 
the sequence of an array in the manner of sidh-1, sidh-2, ■ • • and returning to sid h -l again after 
sidh-p. The extracted one privileged ID information sid h -j is sent from the read/write section 
2624 to the interface 2022 (equivalent to "privileged ID output section"), and thence 
transmitted (delivered) to the tag device 2610 (step S414). 

Please replace the paragraph at page 113, lines 4-6, with the following rewritten 
paragraph: 

Initially, a decrypting processing of privileged ID information which is performed 
when demanding a backend apparatus &Q 3050 to acquire information relating to ID will be 
described. 

Please replace the paragraph at page 1 13, line 26, to page 114, line 17, with the 
following rewritten paragraph: 
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[0219] The transmitted privileged ED information sidh and key ID information kidj are 
received by a communication section 3072 (equivalent to "privileged ID input section") of 
the security server 3070 (accepted as inputs) (step S505), and the privileged ID information 
sid h is fed to a decryptor 74 3074 (equivalent to "ED calculator") while the key ID 
information kidj is fed to a read/write section 3073. The read/write section 3073 (equivalent 
to "key extractor") extracts a secret key skj which corresponds to the key ID information kidj 
which is sent thereto from a key memory 3071, and sends it to the decryptor 3074 (step 
S506). The decryptor 3074 calculates a tag ID information id h which is decrypted from the 
privileged ID information sid h using the privileged ID information sid h and the secret key skj 
which are sent thereto. In this example, the tag ID information id h is calculated by a 
calculation of id h =(id h pkj r )/(g r ) skj . It is to be noted that the index "skj" in this calculation 
formula means "skj". The calculated tag ID information idh is sent to the communication 
section 3072, which then transmits it toward the client apparatus 3020 through the network 
3080 (step S508). The client apparatus 3020 receives the transmitted tag ID information id h at 
its communication section 3021 (step S509), and utilizes this tag ID information id h for a 
subsequent inquiry to the backend apparatus 3050. 
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